diff --git a/.jenkins.d/00-deps.sh b/.jenkins.d/00-deps.sh
index ae45ce5..187f595 100755
--- a/.jenkins.d/00-deps.sh
+++ b/.jenkins.d/00-deps.sh
@@ -8,24 +8,31 @@
 
 if has OSX $NODE_LABELS; then
     FORMULAE=(boost openssl pkg-config)
-    brew update
-    if [[ -n $TRAVIS ]]; then
-        # Travis images come with a large number of brew packages
-        # pre-installed, don't waste time upgrading all of them
-        for FORMULA in "${FORMULAE[@]}"; do
-            brew outdated $FORMULA || brew upgrade $FORMULA
-        done
-    else
-        brew upgrade
+    if has OSX-10.13 $NODE_LABELS || has OSX-10.14 $NODE_LABELS; then
+        FORMULAE+=(python)
     fi
-    brew install "${FORMULAE[@]}"
-    brew cleanup
+
+    if [[ -n $TRAVIS ]]; then
+        # Travis images come with a large number of pre-installed
+        # brew packages, don't waste time upgrading all of them
+        brew list --versions "${FORMULAE[@]}" || brew update
+        for FORMULA in "${FORMULAE[@]}"; do
+            brew list --versions "$FORMULA" || brew install "$FORMULA"
+        done
+        # Ensure /usr/local/opt/openssl exists
+        brew reinstall openssl
+    else
+        brew update
+        brew upgrade
+        brew install "${FORMULAE[@]}"
+        brew cleanup
+    fi
 fi
 
 if has Ubuntu $NODE_LABELS; then
     sudo apt-get -qq update
-    sudo apt-get -qy install build-essential pkg-config libboost-all-dev \
-                             libsqlite3-dev libssl-dev
+    sudo apt-get -qy install build-essential pkg-config python3-minimal \
+                             libboost-all-dev libssl-dev libsqlite3-dev
 
     if [[ $JOB_NAME == *"code-coverage" ]]; then
         sudo apt-get -qy install gcovr lcov libgd-perl
diff --git a/.jenkins.d/01-ndn-cxx.sh b/.jenkins.d/01-ndn-cxx.sh
new file mode 100755
index 0000000..f10956c
--- /dev/null
+++ b/.jenkins.d/01-ndn-cxx.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -e
+
+JDIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
+source "$JDIR"/util.sh
+
+set -x
+
+sudo rm -f /usr/local/bin/ndnsec*
+sudo rm -fr /usr/local/include/ndn-cxx
+sudo rm -f /usr/local/lib{,64}/libndn-cxx*
+sudo rm -f /usr/local/lib{,64}/pkgconfig/libndn-cxx.pc
diff --git a/.jenkins.d/10-build.sh b/.jenkins.d/10-build.sh
index 3d2e3bb..024b6e0 100755
--- a/.jenkins.d/10-build.sh
+++ b/.jenkins.d/10-build.sh
@@ -6,10 +6,8 @@
 
 set -x
 
-sudo rm -f /usr/local/bin/ndnsec*
-sudo rm -fr /usr/local/include/ndn-cxx
-sudo rm -f /usr/local/lib{,64}/libndn-cxx*
-sudo rm -f /usr/local/lib{,64}/pkgconfig/libndn-cxx.pc
+git submodule sync
+git submodule update --init
 
 if [[ $JOB_NAME == *"code-coverage" ]]; then
     COVERAGE="--with-coverage"
@@ -17,23 +15,20 @@
     ASAN="--with-sanitizer=address"
 fi
 
-# Cleanup
-sudo_preserve_env PATH -- ./waf --color=yes distclean
-
 if [[ $JOB_NAME != *"code-coverage" && $JOB_NAME != *"limited-build" ]]; then
     # Build static library in release mode with tests and without precompiled headers
     ./waf --color=yes configure --enable-static --disable-shared --with-tests --without-pch
     ./waf --color=yes build -j${WAF_JOBS:-1}
 
     # Cleanup
-    sudo_preserve_env PATH -- ./waf --color=yes distclean
+    ./waf --color=yes distclean
 
     # Build static and shared library in release mode without tests
     ./waf --color=yes configure --enable-static --enable-shared
     ./waf --color=yes build -j${WAF_JOBS:-1}
 
     # Cleanup
-    sudo_preserve_env PATH -- ./waf --color=yes distclean
+    ./waf --color=yes distclean
 fi
 
 # Build shared library in debug mode with tests and examples
diff --git a/.jenkins.d/20-tests.sh b/.jenkins.d/20-tests.sh
index ec4461b..9c30a19 100755
--- a/.jenkins.d/20-tests.sh
+++ b/.jenkins.d/20-tests.sh
@@ -15,7 +15,7 @@
 
 ndnsec-keygen "/tmp/jenkins/$NODE_NAME" | ndnsec-install-cert -
 
-BOOST_VERSION=$(python -c "import sys; sys.path.append('build/c4che'); import _cache; print(_cache.BOOST_VERSION_NUMBER);")
+BOOST_VERSION=$(python3 -c "import sys; sys.path.append('build/c4che'); import _cache; print(_cache.BOOST_VERSION_NUMBER);")
 
 ut_log_args() {
     if (( BOOST_VERSION >= 106200 )); then